m25man

On the DNS front, if you are using your own ISP (not your RBC) BT decided to change its DNS Server IP addresses this week and a number of systems have fallen over as a result. If your using DNS forwarders check they have valid data. Geoff

God helps us......................... 8O I realise now, that could amount to nearly everything a child types on the keyboard and probably 90% of what they use the computer for. One could be drowned in log files!

IMOHO, I thought the concept of Forensic softwares product was quite good. However it gets detected by most good AV and spyware as a commercial keylogger and thats really what it is! You must look at this product in an unbiased manner, it has great potential in certain problem areas however in other schools it would never pay for itself so some may say why bother in the first place. Where I know it's really good is Girls schools. They are not normally so equipment destructive but they can be terrifyingly vicious to each other. This software catches them red handed time and time again. It intercepts slang usage, excellent for identifying the use of messenger type applications and websites. Close them down in seconds. Evidence, when action is required you need evidence and lots of it, this product gives you all you could ever need. Where it's bad, you would probably want to host it on a dedicated box as it could become a massive resource hog. It has a memory overhead at each client. False positives, as said elsewhere innocent webpages are often grabbed as a potential offence because "sex" was detected somewhere on the page as in "Essex". This can make it difficult to seperate the bad from the good and you might spend far too long trying to find something you can't fix! Cost, I beleive the prices are down on last years, but in 2005 they were asking about £25 per seat going down if you had more than 200 seats. Viglen had this product in the classlink NT4 product under another name Im sure. Lastly if you installed a keylogger on all of your systems you would probably be in breach of some human rights treaty of some sort so a highly visible awareness notice needs to conveyed. So once again what might be a wonderful and useful tool to some may be construed as an awful waste of time and money to another. Securus do a similar product but as an appliance i I think. It's your call.

So what about all the web based gateways? ISA does a great job blocking all the protocols but you then need url detection and blocking to spot when the little buggers find a web gateway. Sorry, but you can throw thousands at this one and still never have a watertight single solution. Catch em and ban em !! Thats the way to do it! Not my favourite software but nevertheless Forensic's product cleverly alerts the admin when slang is being typed on screen be it in Word, Web, Email or messengers and bang! Gotcha.....

Use the Axis Bandwidth Calculators http://www.axis.com/techsup/cam_servers/bandwidth/bw_205.htm To get an idea of what you need to make allowances for. I had a school that had installed 36 IP cameras and was recording to 2 x video servers in the same room as the schools data servers. They also installed Layer3 switches everywhere in anticipation of problems. When I measured the bandwidth used by the cameras they peaked at only 32 mbs through the Gigabit core switch whilst the kids rushed through the corridors during a lesson change after the rush the raffic was barely noticable with average throughput on the core switch at only 8mbs for all data and camera traffic and this site runs over 300 pcs 8 servers and 36 IP cameras! Image size and frame rates are the key but even at 640x480 and 15 fps x 39 the network never broke into a sweat. VLan them by all means if you have the framework to do so but you might be surprised how light these things can be when tweaked properly. Do you know what traffic flows through your switches right now? Find that out, use the bandwidth calcs then add a couple of cams (in the busiest areas) and recheck your figures.

The SCT is meant to be used in a stand alone kiosk environment or workgroup as it performs only local policy management "gpedit.msc" The disk utility however can be used in a domain environment and there are GP extensions for it. Unlike other Disk Locking utilities SCT allows the locked disk to be updated with AV and windows updates something that other systems like "Reborn" cannot do. Deep Freeze might be a brilliant product but when there is a native or free utility that does the same you should test them all before parting with loads of the tax payers cash! Native tools and Free utilities you can't beat them.

Here is Lab #3 the only one I have to hand until we get our servers back on-line after the move from Buncefield.lab_3_workstation_deployment_with_multiple_os.doc

It set's a benchmark in vanilla 2003 School network setups that any newbie or even hardened veteran can learn from. Admins whom have never setup a 2k 2k3 network can use it to set one up from scratch that works well first time and can be tweeked til the cows come home. The veterans can see how M$ recommend school networks are setup and learn from it, tweek and pinch the useful bits for the benifit of their own systems. It doesnt give you any additional functionality you couldn't do yourself or buy a third party solution to do, It does build a bloody good system entirely by itself in a relatively short space of time. I would add, the training labs that go with this product recommend it be used in conjunction with the SCT (the M$ version of deep freeze) so it teaches you how to configure RIS for multi partitions and operating systems. So now I expect you want me to post the training lab documents as well eh!

I've had problems using the /console switch with TFT refresh rates. After connecting using /console the server would not login locally without reporting the refresh rate was not supported. Log back on from the remote pc /console all works fine the only way back so far means a restart remotely and the server will be fine again. Tried all sorts of video settings both remote and local with no joy, so when I move the server tomorrow I will be bringing it back up with a different TFT. I'll wait and see.

If your hellbent on using outlook clients then use exchange server. I've never seen a free one that works except Netfolders that M$ stopped a long time ago because it was awful! Most other working solutions cost money and normally require a syncronisation agent or additional client of some kind to be installed at each workstation. By the time you have deployed clent add-ins everywhere and burdened yourself with additional administration tasks you will wish you had installed an exchange server and had done with it! OWA, Mobile Device support, Syncronisation with god knows how many device types make it well worth the effort of learning how to deploy it. But, Be aware the next encarnation of Exchange drops public folders in favor of a sharepoint solution and as Exchange webparts are a major feature of Sharepoint Services it might pay to look at this type of calendaring solution to begin with. What use is a shared calendar unless all of your groupware participants can cross check schedules and check free/busy conflicts? If you can't use Outlook/Exchange then you would probably be better off looking for another complete solution. We use Outlook clients with RPC over HTTPS full access to all Exchange functions without the need for a VPN just web access from anywhere. It rocks!

Have you sent the image down again? Does it work the second time? Is there a service partition on the target drive? Use a disk util to fully wipe the target drive first, this normally works for me.

There is nothing else to add, Tony has said it all. There are advantages/dis-advantages from both aspects but the advantages of being seamlessly connected to the NGFL access to LEA resources and potential for growth in VLE connected schools, isolating one's self outside in the rain on your own seems a bit big step to take. As we will no doubt shortly see, the takeup of ADSL2+ and 802.16 WiMax in the UK will boost lastmile speeds into both our homes and schools. WiMax mesh networks will reduce the need for expensive fibers and the RBC's will be able to provision schools at higher speeds and lower costs. The RBC's will have to play leapfrog with advances in network technology and schools will have to learn to be patient as the systems adapt to higher demands and heavier loads. The grass always looks greener on the other side of the street but when you cross over is full of worm casts!

Have you tried debugging with riprep -pnp Over the years of wrestling with ris I found most of my answers here. http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c02621675.mspx

I use Ethereal where possible and LanHound with remote agents. But you didn't say what it was you were trying to observe? As Ric said switches intelligently route traffic between MAC addresses so you need a way of ""sniffing" the traffic across the target node. Most good managed switches have Port Mirroring, just plug your lappy into an empty port and program the switch to mirror the link you wish to monitor to the port you have the lappy in easy. Protocol analyzers are brilliant for tracing unwanted traffic sources and worms but snmp is the best way to determine real time bandwidth usage. If you want to monitor realtime traffic then enable snmp on your servers and swtches and use Solarwinds to monitor the snmp agents. Solarwinds Engineers Edition is my tool of choice (http://www.solarwinds.net) but it's expensive so we get our school admins to buy the standard toolkit and teach them how to use it correctly. Cisco, HP and 3Com all come with extremely good network monitoring applications but almost everything else requires you to spend loads of cash on add on suites so there's one good reason to buy quality networking kit in the first place!

Ric, The MSLNM.ISO should be bootable, the lnm.iso inside the file structure is used by the LNM setup proceedure. Do not modify the disk structure. Drop me a PM if you want a copy of my iso Geoff

What HAL type is the riprep image for and what type of machine are you sending them to? Is the riprep image being used from the exact same hardware? As soon as the system starts up it will do a pnp check and will expect to find all of the correct inf files it needs in the windows system folders or the oem pnpdrivers search paths. Check out the pnpdrivers paths in the registry keys of the source image if they refer to a path that is not available to the hardware or user during pnp it will fail. Geoff

The GUI does not provide those options however this will not affect the abilty to implement them. The user interface and associated code is easily modifiable and I expect techies will be tweaking the interface to reflect their own want's and needs.

M$ expect you to use RDP and the request support services. If you want more look at NetSupport Manager or something like that.

Why not use one of the many sizing tools that are out there, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/bdadotnetarch081.asp We came across one school that had 11 DC's after fixing a few simple DNS problems we were able to drop this down to 2 and re-assigned the others to member server task roles

LNM is designed to accelerate the deployment of Server 2003 SP1 and XP Pro SP2. You will be asked to input your product keys during the setup process. These MUST be a valid VLK (Volume License Key) The use of OEM or Retail keys will result in issues due to product activation mechanisms. Only Select or School Agreement OS's should be deployed with LNM Geoff

MS STC does this, it's free and allows patching and updates to the OS to happen with windows update or WSUS also has a GP setting. I would try this before parting with 3.8k Geoff

Hi Guy's I will make a few copies available tomorrow SATURDAY at our stand E74 ask for Geoff, I will be doing the breifing for LNM. LNM was developed for Microsoft by ITWORX to assist in the deployment of 2003 Networks for the Saudi Ministry of Education (and others). It will automatically build a 2003 AD Network specifically tailored to Schools requirements instead of the proverbial Consoto Coffee Co model we all know so well, from bare metal to working system in under an hour. Now most of you will already know how to do this but, can you deploy the server, configure RIS and Terminal Server (Application Mode), develop a set of working policies and role out your first workstation in under an hour. I don't think so! This is a set of very clever sif files, PE routines, VB and pearl scripts that transform the usual bog standard 2k3Server into a usable school system very quickly. Most Geeks will be happy to extract, dis-assemble, reverse engineer and suck all the good routines out of LNM and pass them off as their own to impress their bosses, however there will be many less experienced school network admins who will find great comfort in having LNM give them a jump start in setting up a very slick native Win 2k3 system without handing over loads of cash to the likes of RM, Viglen, CSE and others. LNM is the Zenworks of Windows, if it had been around five years ago most school admins would have been a lot more familiar with AD by now! Don't knock this application, it's free it's well thought through and the only thing that needs sorting quickly is the password reset process that expects a kid to remember a seven character randomly generated strong password during the long walk back from IT to the class room! It has been well received by most school techies, as a training tool to excercise deployment techniques and the end result is good enough for most schools to get started with the native OS and kick away that crutch (RM and others) that they have become dependent on because they lacked the confidence to go native. As a VAR we are using the kit ourselves (slightly modified) to deploy systems for our clients and the time saved up front is then used to deploy back end services such as sharepoint. If you can't get there Saturday and are still desperate to see what LNM has to offer I will post a download link here next week once we have had a chance to move into our new premises, the old place was flattened by the Buncefield fiasco and we have been working out of peoples living rooms for nearly a month. Geoff

Webdav publishing is native to Windows, is installed with a mouse click and uses native windows authentication. Use SSL and you can be accessing home areas and other files through a web browser easily. Most LEA's permit Port 443 inbound to a target webserver if setup correctly and doesn't normally need you to submit a DNA sample to the LEA's IT Dept in triplicate before your Broadband provisioning team can do it! Using forms based authentication lets you script around the troublesome DOMAIN\username login dialog boxes. Using ISA as an internal firewall allows routing to take place at application layer with a single sign-on thus specific servers can be targeted by url alone eg student.myschool.org uk can be routed to one server while staff.myschool.org.uk routes to another. Add to this access to the intranet and the .net sims data ..... Hey haven't we just invented the "E-Portal"..... Lets call it???? I know! "ClassServer" that sounds good. LOL Joking aside ISA2004 routes/publishes/redirects based upon virtually any combination of rules you can think of thats why it's the tool of choice for these remote access solutions in schools. VPN don't even go there, even if you had the budget to ensure everyone who might want to use it can, the overhead will prove taxing for most school servers and once attached and authenticated that sixth formers home pc is now bound to your own lan subnet...... SSL and a web browser is secure from end to end without the need to "glue" some little oik's home computer to your lan and has to be the only way to some yourself from catching something nasty! Terminal Services/Citrix is another way but even if you can afford the extra hardware what about the licensing costs! One of the schools I look after had a couple of Uni Guys in on placement and they said "Why can't we let the kids use the PC's in the labs from home" Why not I said, we do it all the time using "Remote Web Workspace" which is a default part of IIS in Small Business Server. By re-working this method we can extend this functionality to an entire school. First kids log in to the school website https://myschool/remote from home. Then choose from the list of available workstations, login as usual with the same username/password then use your home areas and all of the curriculum software just as you do when at school all with the same level of control/logging/restriction as they do when they are at school. We are piloting the asp's and components as we speak but I can assure you you won't find a cheaper and more simplified way of doing what you are trying to achieve. Can't tell you anymore than that as we will be using the feature in our own products but Im sure it will give a few people some fresh ideas. Geoff